fix: OTR/presence/OMEMO correctness, stanza-id disco gate, build hardening

- OTR: strip the whitespace tag by shifting the full message tail incl. the NUL, not tag_length bytes, so the body is no longer duplicated for messages longer than the tag.
- presence: snapshot the resource fields before connection_add_available_resource() takes ownership, removing a use-after-free in the own-presence path.
- OMEMO: propagate _omemo_finalize_identity_load() failure on connect (log + cons_show_error + stop) instead of leaving OMEMO silently unavailable.
- OMEMO: guard NULL fingerprint decode in _omemo_fingerprint_decode / omemo_is_trusted_identity / omemo_trust and log every decode failure instead of failing silently.
- stanza-id: gate XEP-0359 dedup on disco urn:xmpp:sid:0 (the `by` JID or its domain), falling back to no-dedup when caps are unknown; add functional tests for trusted vs untrusted server.
- accounts: narrow the group-name sanitizer to the characters GKeyFile forbids in headers ([ ] \n \r), keeping `=` and `#`, so read/write stays symmetric.
- build: re-introduce compiler/sanitizer flags in a Pikaur-safe form (opt-in sanitizers, -Wsign-compare) and fix the resulting -Wsign-compare warnings (incl. proftest _mkdir_recursive).fix: OTR/presence/OMEMO correctness, stanza-id disco gate, build hardening

Author: jabber.developer2 <jabber.developer2@jabber.space>

src/xmpp/message.c

@@ -65,6 +65,7 @@ static void _handle_pubsub(xmpp_stanza_t* const stanza, xmpp_stanza_t* const eve
 static gboolean _handle_form(xmpp_stanza_t* const stanza);
 static gboolean _handle_jingle_message(xmpp_stanza_t* const stanza);
 static gboolean _should_ignore_based_on_silence(xmpp_stanza_t* const stanza);
+static gboolean _stanza_id_by_trusted(const char* by);
 #ifdef HAVE_OMEMO
 static void _receive_omemo(xmpp_stanza_t* const stanza, ProfMessage* message);
 #endif
@@ -1088,7 +1089,7 @@ _handle_groupchat(xmpp_stanza_t* const stanza)
     xmpp_stanza_t* stanzaidst = xmpp_stanza_get_child_by_name_and_ns(stanza, STANZA_NAME_STANZA_ID, STANZA_NS_STABLE_ID);
     if (stanzaidst) {
         const char* by = xmpp_stanza_get_attribute(stanzaidst, "by");
-        if (by && (g_strcmp0(by, from_jid->barejid) == 0)) {
+        if (by && g_strcmp0(by, from_jid->barejid) == 0 && _stanza_id_by_trusted(by)) {
             stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
             if (stanzaid) {
                 message->stanzaid = strdup(stanzaid);
@@ -1397,7 +1398,7 @@ _handle_chat(xmpp_stanza_t* const stanza, gboolean is_mam, gboolean is_carbon, c
         xmpp_stanza_t* stanzaidst = xmpp_stanza_get_child_by_name_and_ns(stanza, STANZA_NAME_STANZA_ID, STANZA_NS_STABLE_ID);
         if (stanzaidst) {
             const char* by = xmpp_stanza_get_attribute(stanzaidst, "by");
-            if (by && equals_our_barejid(by)) {
+            if (by && equals_our_barejid(by) && _stanza_id_by_trusted(by)) {
                 stanzaid = (char*)xmpp_stanza_get_attribute(stanzaidst, STANZA_ATTR_ID);
                 if (stanzaid) {
                     message->stanzaid = strdup(stanzaid);
@@ -1735,3 +1736,22 @@ _should_ignore_based_on_silence(xmpp_stanza_t* const stanza)
     }
     return FALSE;
 }
+
+// XEP-0359 §6 disco-gate; falls back to domain since that's what disco is run against.
+static gboolean
+_stanza_id_by_trusted(const char* by)
+{
+    if (!by) {
+        return FALSE;
+    }
+    GHashTable* features = connection_get_features(by);
+    if (features && g_hash_table_contains(features, STANZA_NS_STABLE_ID)) {
+        return TRUE;
+    }
+    const char* at = strchr(by, '@');
+    if (!at) {
+        return FALSE;
+    }
+    features = connection_get_features(at + 1);
+    return features && g_hash_table_contains(features, STANZA_NS_STABLE_ID);
+}